Methods and apparatus for detecting and limiting focused server overload in a network

Abstract

Computer-based methods and apparatuses, including computer program products, are described for detecting and limiting focused server overload in a network. A feedback message is received from a downstream server, wherein the feedback message includes a communication protocol statistic. The methods and apparatuses determine which of one or more counters that store a number of feedback messages received that include the statistic, from an array of counters, are associated with the downstream server using one or more hash functions based on information included in the feedback message. The one or more counters are incremented in response to the feedback message including the statistic. Using the one or more hash functions, a value of the number stored in the one or more counters is determined. The value is determined to be indicative of an overload episode in the network for the downstream server based on whether the value satisfies a predetermined criteria.

1 . A computerized method for limiting server overload in a network, the method comprising:
 receiving, by a server node of a network, a feedback message from a downstream server, wherein the feedback message comprises a statistic of a communication protocol;   determining, by the server node, which of one or more counters, from an array of counters stored in a computer memory module, are associated with the downstream server using one or more hash functions based on information included in the feedback message, wherein the one or more counters store a number corresponding to how many feedback messages have been received from the downstream server that include the statistic;   incrementing, by the server node, the one or more counters in response to the feedback message including the statistic;   determining, by the server node, using the one or more hash functions, a value of the number stored in the one or more counters; and   determining, by the server node, that the value is indicative of an overload episode in the network for the downstream server based on whether the value satisfies a predetermined criteria.   
     
     
         2 . The method of  claim 1 , wherein the predetermined criteria is a threshold, and determining comprises determining the value is greater than the threshold. 
     
     
         3 . The method of  claim 2 , wherein the threshold is calculated using hysteresis. 
     
     
         4 . The method of  claim 1 , further comprising identifying one or more sources that are responsible for causing the overload episode, wherein each source initiated a transmission to the downstream server that caused the downstream server to transmit a feedback message including the statistic. 
     
     
         5 . The method of  claim 1 , further comprising determining one or more control parameters for performing a control action based on the value, wherein the control action reduces a transmission rate of data from one or more sources responsible for causing the overload episode to the downstream server. 
     
     
         6 . The method of  claim 5 , further comprising:
 transmitting the one or more control parameters to a server node between a source responsible for causing the overload episode and the downstream server; and   performing the control action at the server node on data transmitted from the source to the downstream server by reducing a transmission rate of data transmitted from the source to the downstream server, wherein the reduction is performed based on the one or more control parameters.   
     
     
         7 . The method of  claim 5 , wherein the transmission rate is a call attempt rate of the one or more sources responsible for causing the overload episode to the downstream server. 
     
     
         8 . The method of  claim 5 , wherein determining the one or more control parameters comprises:
 determining an action location that specifies where to take the control action;   determining an action filter that defines one or more sources to which to apply the control action at the action location; and   determining an action level for the control action.   
     
     
         9 . The method of  claim 8 , wherein determining the action level comprises:
 determining if the value is greater than a predetermined threshold; and   if the value is greater than the predetermined threshold, determining the action level to be a decrease from a previous action level using a decrease factor; or   if the value is less than the predetermined threshold, determining the action level to be an increase from the previous action level using an increase step.   
     
     
         10 . The method of  claim 9 , wherein the threshold is calculated using hysteresis. 
     
     
         11 . The method of  claim 9 , wherein determining comprises:
 determining if the value is equal to a predetermined target; and   if the value is equal to the predetermined target, not modifying the action level; or   if the value is not equal to the predetermined target, determining the action level based on a previous action level and a difference between the value and the predetermined target.   
     
     
         12 . The method of  claim 9 , further comprising distributing the one or more control parameters to the action location. 
     
     
         13 . The method of  claim 1 , further comprising:
 receiving a second feedback message from a second downstream server, wherein the second feedback message includes the statistic;   determining which of one or more counters from the array of counters are associated with the second downstream server using one or more hash functions based on information included in the second feedback message; and   incrementing the one or more counters in response to the second feedback message including the statistic.   
     
     
         14 . The method of  claim 1 , further comprising:
 storing a plurality of arrays of counters, wherein each of the plurality of arrays of counters is stored at a different server node; and   aggregating the plurality of arrays of counters to calculate how many feedback messages have been received from each downstream server associated with the plurality of arrays of counters across the different server nodes.   
     
     
         15 . The method of  claim 1 , wherein:
 the communication protocol is a Session Initiation Protocol (SIP); and   the statistic is a session rejection, overload feedback from the downstream server, or both.   
     
     
         16 . The method of  claim 1 , wherein the communication protocol is session initiation protocol (SIP), hypertext transfer protocol (HTTP), Stream Control Transmission Protocol (SCTP) or transmission control protocol (TCP). 
     
     
         17 . The method of  claim 1 , wherein the one or more hash functions and the array of counters are associated with a counting bloom filter. 
     
     
         18 . The method of  claim 17 , wherein determining which of one or more counters are associated with the downstream server comprises determining the one or more counters using hash functions associated with a key, wherein the key is an identifier for the downstream server. 
     
     
         19 . The method of  claim 1 , wherein incrementing comprises:
 incrementing the one or more counters by one; or   incrementing the one or more counters by a number greater than one, wherein the number greater than one is determined based on the statistic, statistics received from the downstream server over a period of time, statistics received from the downstream server over a plurality of periods of time, a type of transmission from a source to the downstream server, or any combination thereof.   
     
     
         20 . The method of  claim 1 , further comprising distributing a multi-level threshold based bloom filter to an action location, wherein the multi-level threshold based bloom filter stores:
 a plurality of thresholds, wherein each of the plurality of thresholds corresponds to a class from a plurality of classes associated with a call request for the communication protocol; and   a count of call requests to the downstream server for each of the plurality of classes using one or more hash functions.   
     
     
         21 . The method of  claim 20 , further comprising:
 receiving a call request message from a source to the downstream server, wherein the call request message comprises a class from the plurality of classes;   determining, using the multi-level threshold based bloom filter, (1) a threshold for the class in the call request message, and (2) a count of call requests to the downstream server for the class in the call request message based bloom filter using the one or more hash functions; and   if the count of call requests is greater than the threshold, denying the call request message; or   if the count of call requests is less than the threshold, admitting the call request message.   
     
     
         22 . The method of  claim 1  wherein the statistic is a failed connection request from a source to the downstream server, an overload notification from the downstream server, or both. 
     
     
         23 . A system for limiting server overload in a network, the system comprising:
 a computer memory module configured to store an array of counters; and   a controller in communication with the computer memory module comprising:
 a computing means for receiving a feedback message from a downstream server, wherein the feedback message comprises a statistic of a communication protocol; 
 a computing means for determining which of one or more counters, from the array of counters, are associated with the downstream server using one or more hash functions based on information included in the feedback message, wherein the one or more counters store a number corresponding to how many feedback messages have been received from the downstream server that include the statistic; 
 a computing means for incrementing the one or more counters in response to the feedback message including the statistic; 
 a computing means for determining, using the one or more hash functions, a value of the number stored in the one or more counters; and 
 a computing means for determining that the value is indicative of an overload episode in the network for the downstream server based on whether the value satisfies a predetermined criteria. 
   
     
     
         24 . A computer program product, tangibly embodied in a machine-readable storage device, the computer program product including instructions being operable to cause a data processing apparatus to:
 receive a feedback message from a downstream server, wherein the feedback message comprises a statistic of a communication protocol;   determine which of one or more counters, from an array of counters stored in a computer memory module, are associated with the downstream server using one or more hash functions based on information included in the feedback message, wherein the one or more counters store a number corresponding to how many feedback messages have been received from the downstream server that include the statistic;   increment the one or more counters in response to the feedback message including the statistic;   determine, using the one or more hash functions, a value of the number stored in the one or more counters; and   determine that the value is indicative of an overload episode in the network for the downstream server based on whether the value satisfies a predetermined criteria.